critique
CVE-2016-1908
openssh: possible fallback from untrusted to trusted X11 forwarding
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9AV:N/AC:M/Au:S/C:P/I:P/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Ubuntu (faible).
Description
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | openssh, openssh-clients, openssh-debuginfo et 4 autres | 6.6.1p1-25.61.amzn1 et 1 autres |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | pas de correctif indiqué |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh, openssh-askpass, openssh-clients et 3 autres | 5.3p1-117.el6 et 1 autres |
| Oracle Linux 7 | openssh, openssh-askpass, openssh-clients et 5 autres | 6.6.1p1-25.el7_2 et 1 autres |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
Afficher les 37 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | openssh | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-clients | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-debuginfo | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-keycat | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-ldap | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-server | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | pam_ssh_agent_auth | 0.9.3-9.25.61.amzn1 |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | pas de correctif indiqué |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-askpass | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-clients | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-ldap | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-server | 5.3p1-117.el6 |
| Oracle Linux 6 | pam_ssh_agent_auth | 0.9.3-117.el6 |
| Oracle Linux 7 | openssh | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-askpass | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-clients | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-keycat | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-ldap | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server-sysvinit | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.25.el7_2 |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 13 | rootio-openssh | 1:7.2p1-1 |
| seal Red Hat 6 | openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 6 | seal-openssh | 5.3p1-124.el6_10+sp999 |
| ubuntu 12.04 | openssh | 1:5.9p1-5ubuntu1.9 |
| ubuntu 14.04 | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 14.04-ESM | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 15.10 | openssh | 1:6.9p1-2ubuntu0.2 |
Références
- http://openwall.com/lists/oss-security/2016/01/15/13
- http://rhn.redhat.com/errata/RHSA-2016-0465.html
- http://rhn.redhat.com/errata/RHSA-2016-0741.html
- http://seclists.org/oss-sec/2016/q1/115
- http://www.openssh.com/txt/release-7.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84427
- http://www.securitytracker.com/id/1034705
Les 21 références
- https://access.redhat.com/security/cve/CVE-2016-1908
- https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
- https://bugzilla.redhat.com/show_bug.cgi?id=1298741
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://linux.oracle.com/cve/CVE-2016-1908.html
- https://linux.oracle.com/errata/ELSA-2016-0741.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-1908
- https://security.gentoo.org/glsa/201612-18
- https://thejh.net/written-stuff/openssh-6.8-xsecurity
- https://ubuntu.com/security/notices/USN-2966-1
- https://www.cve.org/CVERecord?id=CVE-2016-1908